Te Whakapakari i te Haumarutanga Pūmanawa i te Wā o ngā Whakaekenga mekameka tuku #
Te pikinga ake ngā whakaekenga mekameka tuku pūmanawa kua hanga he haumarutanga CI/CD pipelines a ngā taonga pūmanawa nui atu i ngā wā katoa. He aha te SLSA? te Ngā Taumata mekameka tuku mō ngā Taonga Pūmanawa anga whakaratohia huarahi hanganga ki te haumarutanga pūmanawa, te whakarite te pono o ngā taonga tuku iho puta noa i te huringa whanaketanga. Ko tētahi āhuatanga matua o tēnei anga ko SLSA Provenance, e manatoko ana kei hea, āhea, me pēhea i hangaia he pūmanawa, hei ārai i te whakararuraru me ngā whakarerekētanga kāore i whakamanahia. Mā te whakamahi i ngā tikanga haumarutanga o Ngā Taumata Mekameka Tuku mō ngā Taonga Pūmanawa, ka taea e ngā whakahaere whakapakari i tā rātou mekameka tuku pūmanawa me te hanga whakawhirinaki ki tā rātou tukanga whanaketanga..
Nga wehewehe:
He aha te SLSA? #
Ko te Supply-chain Levels for Software Artifacts (SLSA) he anga haumarutanga i hangaia hei tiaki i ngā mekameka tuku pūmanawa mai i ngā tūmomo riri. Ka whakarite kia haumaru te hanga me te tohatoha pūmanawa, hei ārahi i ngā whakahaere mai i te aunoatanga taketake ki ngā tukanga ka taea te whai me te ārai i ngā whakarerekētanga.
he aha te mea SLSA Provenance? #
SLSA Provenance he tuhinga taipitopito mō te wāhi, te wā, me te āhua o te hanganga o te pūmanawa. Ka whakarite i te pono o ngā taonga tuku iho, ka whakarato i te tirohanga katoa ki ngā wāhanga pūmanawa me ngā whakawhirinakitanga. Me SLSA Provenance, ka taea e ngā whakahaere te aukati i te raweketanga, te manatoko i te whakawhirinaki, me te pupuri i te mana whakahaere katoa mō tā rātou mekameka tuku pūmanawa.
Nga Taketake o te SLSA Provenance #
I whakawhanakehia te anga Taumata mekameka tuku mō ngā Taonga Pūmanawa hei aro atu ki ngā tūmomo riri e tipu haere ana i roto i te mekameka tuku pūmanawa. Ko ngā whakaekenga pēnei i SolarWinds me CodeCov i whakakitea ngā ngoikoretanga o te hanga, te manatoko, me te tohatoha o te pūmanawa. Nā reira, I hangaia e Google te SLSA, e whakamahi ana i ana mahi haumarutanga ā-roto, hei āwhina i ngā whakahaere ki te tiaki i ā rātou CI/CD pipelineme ngā taonga pūmanawa.
I ēnei rā, ko ngā Taumata Mekameka Tuku mō ngā Taonga Pūmanawa e whakahaeretia ana e OpenSSF (Open Source Security (Ture) i raro i te Linux Foundation. Ka whakaratohia he huarahi mārama, taahiraa-i-te-taahiraa hei whakapai ake i te pono o te pūmanawa, te haumarutanga o ngā taonga tuku iho, me te aroturuki i te pūtake. He rerekē ki ngā anga haumarutanga tukutuku whānui pērā i te NIST, i te CIS Ko ngā Mana Whakahaere, e arotahi ana a SLSA ki te haumarutanga whanaketanga pūmanawa, me te whakarite kia ātete ki ngā whakarerekētanga me te manatoko i ngā hanganga.
Ma te whakamahi SLSA Provenance, ka taea e ngā whakahaere te aroturuki i ia wāhanga o te huringa ora o ā rātou pūmanawa. Mā tēnei ka whakarite i te māramatanga, te haumarutanga, me te tutuki i ngā whakaritenga, ka whakaiti i te mōrearea o ngā whakarerekētanga kāore i whakamanahia me ngā whakararuraru i te mekameka tuku.
Ngā Ariā Matua o ngā Taumata Mekameka Tuku mō ngā Taonga Pūmanawa #
Ngā Whakamārama mō ngā Taumata SLSA #
| Taumata SLSA | Ngā Mea e Whakapūmautia ana e Ia | Hua Haumarutanga |
|---|---|---|
| taumata 1 | Ngā hanga aunoa | Ka whakaiti i ngā hapa tangata me te whakarerekētanga tūpono |
| taumata 2 | Manatoko pūtake + mana whakahaere kaha ake | Ka whakarite i te pono o te waehere me ngā hanganga pono |
| taumata 3 | SLSA Provenance hiahiatia | E whakarato ana i ngā tuhinga taipitopito mō te hanga me te wāhi i hangaia ai ngā taonga tuku iho |
| taumata 4 | Ngā hanganga ka taea te tārua me te pūtake katoa | Ka whakamana i ngā taonga kore e taea te whakarerekē me te haumarutanga mōrahi o te mekameka tuku |
He pēhea te whakataurite o ngā taumata mekameka tuku mō ngā pūmanawa ki ētahi atu anga haumarutanga? #
Anga Haumarutanga Ipurangi SLSA me te NIST: #
arotahiHe aratohu whānui tā te NIST mō te haumarutanga tukutuku whānui, engari kāore e aro nui ana ki te tiaki i ngā mekameka tuku pūmanawa.
paingaKo ngā Taumata Mekameka Tuku mō te Pūmanawa e aro nui ana ki te tiaki i te pono o te pūmanawa, ā, e tuku ana i ngā mahi mārama mō te tiaki i ngā taonga pūmanawa me SLSA Provenance, hei tautoko i te huarahi whānui a NIST.
Ngā Taumata mekameka SLSA vs. Tauira Pakeketanga Whakapūmau Pūmanawa OWASP (SAMM): #
arotahiMā te OWASP SAMM ka āwhina i te waihanga rautaki haumarutanga mō ngā kaupapa pūmanawa.
paingaKo ngā Taumata Mekameka Tuku mō te Pūmanawa e ruku hohonu ana ki te haumarutanga mekameka tuku. E arotahi ana ki te pūtake me te āheinga ki te whakaputa anō, ko te SAMM ia e kapi ana i te haumarutanga whānui. SLSA Provenance ka whakarite i te haumaru me te pono o ngā taputapu pūmanawa.
Ngā Taumata mekameka tuku vs. CIS mana: #
arotahi: CIS Ka hoatu e ngā mana whakahaere he aratohu mō te haumarutanga o ngā pūnaha hangarau mōhiohio, engari kāore e arotahi ki te whakawhanaketanga pūmanawa, ki ngā taonga rānei.
painga: Mā ngā Taumata Mekameka Tuku mō te Pūmanawa ka whakaratohia he hikoinga mārama mō te tiaki i ngā hanganga pūmanawa, mā te whakamahi i Ngā Taumata mekameka tuku mō ngā Taonga Pūmanawa Anga hei manatoko kei te haumaru ia hanganga, ā, kāore he whakarerekētanga.
He aha i whiriwhiria ai ngā taumata mekameka tuku mō ngā pūmanawa i runga ake i ētahi atu? #
He maha ngā anga haumarutanga, engari ko ngā Taumata Mekameka Tuku mō te Pūmanawa te mea e tū motuhake ana mā te arotahi ki te mekameka tuku pūmanawa. E tuku ana i ngā mahi ngāwari ki te whai hei whakapai ake i te pono me te pūtake o te pūmanawa, ā, he kōwhiringa pai tēnei i te taha o ngā anga haumarutanga whānui.
- Arotahi ki te Mekameka TukuKua hangaia ngā Taumata Mekameka Tuku mō te Pūmanawa hei tiaki i ngā mekameka tuku pūmanawa, me te whakarato aratohu mārama mō te pono o ngā taonga tuku iho me SLSA Provenance.
- Ngā Taumata WhakapūmauMā ngā taumata taumata ka taea e ngā whakahaere te whakapai ake i te haumarutanga i ia taahiraa, kia mārama ai te ara mō te whakapai tonu.
- Te Pono o ngā Taonga TawhitoE whakanui ana te anga i te āheinga ki te tāruarua me te pūtake mai, kia mau ai te haumarutanga pūmanawa i ngā huarahi kāore e taea e ētahi atu anga.
- Kapinga KatoaMā te tiaki i te pūmanawa mai i te waehere ki te taonga tuku iho, ka whakaratohia e ngā Taumata Mekameka Tuku mō te Pūmanawa te tiakitanga katoa o te mekameka tuku, me te whakarite kia kore e taea te whakarerekē ngā hanganga me SLSA Provenance.
- Ko nga koreroHe pai te mahi a ngā Taumata Mekameka Tuku mō ngā Pūmanawa me ngā angamahi pēnei i a NIST, CIS Ngā mana whakahaere, te whakarei ake i te haumarutanga whānui mā te aro atu ki ngā ngoikoretanga o te mekameka tuku pūmanawa.
Te Whakapūmau i te Ao o te Ao me te SLSA mō ngā Pūmanawa me Xygeni #
Nā te mea kua mōhio koe ki te aha te slsa, me kōrero tāua mō XygeniKa āwhina a Xygeni i ngā whakahaere ki te whakatinana me te pupuri i te tutuki i ngā Taumata Mekameka Tuku mō ngā Pūmanawa i ngā taumata katoa. E hangai ana tā mātou tūāpapa ki āna whakaritenga pakari. standards, e whakangawari ana i te whakaurunga haumarutanga puta noa i tō huringa ora pūmanawa. Mai i te aunoa i ngā hanganga ki te whakamana i te ārai-whakarerekētanga SLSA Provenance ngā mana whakahaere, ka whakapakari a Xygeni i te haumarutanga pūmanawa me te whakahaere i ngā hanganga ture.
Na roto i SLSA Provenance, ka whakarite a Xygeni kia taea te manatoko i te takenga mai me te tukanga hanga o ia taonga pūmanawa. Mā tēnei ka ārai i ngā huringa kāore i whakamanahia, i ngā mahi tāmi rānei, ā, ka kitea katoatia tō mekameka tuku pūmanawa. Nō reira, ka kaha ake te ātete o tō whakahaere ki ngā tūmomo riri e whanake haere ana. Mā te mahi tahi me Xygeni, ka taea e koe te whakatere māia i ngā taumata o ngā Taumata Mekameka Tuku Pūmanawa, kia mau ai te haumaru o ō mekameka tuku pūmanawa i te heke mai. Ka tiakina e Xygeni ngā hanga, ka whakamanahia te pono o ngā taonga me SLSA Provenance, ā, e whakarato ana i tētahi otinga whānui mō te haumarutanga pūmanawa hou.
Pātai Auau #
Ko te SLSA (Supply-chain Levels for Software Artifacts) he anga e whakarei ake ana i software supply chain security mā te aukati i te whakararuraru me te whakarite i te pono o ngā taonga tuku iho mā te SLSA ProvenanceHe mea nui tēnei mō CI/CD pipelines i te mea ka whakatūria he turanga haumarutanga puta noa i ngā tukanga hanga me te tohatoha pūmanawa.
Ko te SLSA tētahi o ngā mea tino pai rawa atu standards mō te whakapūmau CI/CD pipelines. E whakarato ana i ngā aratohu whānui hei pupuri i ia taahiraa o te pipeline—mai i te whakahaere waehere pūtake ki te tuku taonga tuku iho—mā te aukati i te whakapōrearea me te urunga kore whakamanatanga. SLSA Provenance manatoko me te whakarite i te pono o ngā taonga tuku iho puta noa i te tukanga.
I te tuatahi i whakawhanakehia e Google te anga SLSA, ā, ko te OpenSSF (Open Source Security (Foundation) kei te whakahaere inaianei. E whakatairanga ana tēnei whakahaere i ngā mahi pai mō te tiaki i ngā mekameka tuku pūmanawa, ā, e whakapai tonu ana i te anga hei whakatutuki i ngā hiahia haumarutanga hou.
Kāore e oti te mārama ki te tikanga o te SLSA mēnā kāore e mōhio ki ngā raruraru e whakatikahia ana e ia. He ngoikore ngā mekameka tuku pūmanawa ki te whakarerekētanga, ki ngā whakaeke whakawhirinakitanga, me ngā tukanga hanga kore haumaru. SLSA Provenance e whakatau ana i ēnei mā te whakarite kia taea te whai i ngā mahi pūmanawa katoa, kia taea te manatoko, kia ātete hoki ki te whakarerekē. Ka kawea mai e ia te māramatanga me te whakawhirinaki ki CI/CD pipelines, e hanga ana i te haumarutanga hei mea taunoa, ehara i te mea i muri mai.
